UTT HiPER 2610G CVE-2026-11516

Exploitation requires the attacker to be on the same network segment or a directly adjacent layer-2/layer-3 segment as the HiPER 2610G (AV:A - adjacent network vector; internet-side remote exploitation is not indicated by the available data). A low-privilege authenticated session on the device's web management interface is a mandatory prerequisite (PR:L), meaning valid credentials must be obtained before the overflow can be triggered. The /goform/formNatStaticMap endpoint must be reachable and the NAT static mapping functionality must be available in the web UI, which is a default state for this device class. Factors that limit exploitation: the adjacency constraint restricts the attacker pool to on-LAN or directly connected network participants; credential possession is required and cannot be bypassed; and the scope-unchanged rating (S:U) means successful exploitation does not automatically pivot to other systems. No user interaction is required once credentials are held (UI:N).

The CVSS 3.1 base score of 5.5 (Medium) accurately reflects meaningful constraints: AV:A limits exploitation to adjacent-network segments rather than the open internet, and PR:L requires a valid authenticated session, introducing a credential barrier. The scope-unchanged (S:U) rating indicates the overflow does not inherently break out of the device's trust boundary. Impact is uniformly low (C:L/I:L/A:L), suggesting partial memory corruption rather than full remote code execution in most scenarios. Against these dampening factors, the publicly available PoC on GitHub (https://github.com/HungryGoogle/log_attack/tree/main/index1) reduces exploitation complexity for any attacker already positioned on the network. CISA KEV status is absent, meaning confirmed widespread active exploitation has not been documented. The RC:R temporal metric signals reasonable but not vendor-confirmed confidence in the vulnerability details - UTT has not published an advisory in the available references. EPSS data is not provided. Real-world priority is moderate for enterprise environments where the device is deployed on internal networks accessible to multiple users, and lower for tightly segmented deployments; the adjacent-vector constraint is the primary limiting factor.

An attacker with valid low-privilege credentials on the UTT HiPER 2610G - obtained via credential reuse, brute force, or a compromised insider account - submits a crafted HTTP POST request to /goform/formNatStaticMap with a deliberately oversized NatBinds parameter value. The unsafe strcpy call copies the unbounded input into a fixed-size buffer, overwriting adjacent memory regions and potentially corrupting control flow data such as return addresses. The public PoC hosted at https://github.com/HungryGoogle/log_attack/tree/main/index1 provides a reproducible template, meaning any network-adjacent attacker with credentials can execute this attack without advanced exploit development skills.